ActiveDirectory with VBA Part 6 - Extending the AD LDS Schema

So although following the instructions in the Technet tutorials and followed in parts 1, 2 and 4 is fine it seems AD LDS is extensible and the given schema in those tutorials is limited. If you want an extended set of object classes then you need to Extened the AD LDS Schema but there is a typo in the given command line which is corrected here

Once the schema has been extended then the New Object dialog box should show a far greater list of object that you can create.

ActiveDirectory with VBA Part 5 - Querying LDAP with ADO

So in addition to using the GetObject("LDAP//... syntax one can also query LDAP Active Directory using ActiveX Data Objects (ADO). You will need to use the Microsoft OLE DB Provider for Microsoft Active Directory Service.

I can give some VBA which queries the AD LDS instance created in part 1, part 2 and part 4 of this series. If you run the following code you should get the table of results shown below.

Sub QueryingLDAPWithADO()
    Dim cn As ADODB.Connection
    Set cn = New ADODB.Connection
    cn.ConnectionString = "Provider=ADSDSOObject" '* ref https://msdn.microsoft.com/en-us/library/aa746471(v=vs.85).aspx
    cn.Open

    Sheet1.Cells.ClearContents
    Sheet1.Range("A1:F1").Font.Italic = False
    Sheet1.Range("A1:F1").Font.Bold = True
    Sheet1.Range("A2:F2").Font.Italic = True


    Dim cmdSQL_Dialect As ADODB.Command
    Set cmdSQL_Dialect = New ADODB.Command
    cmdSQL_Dialect.CommandText = "Select nAME,distinguishedName FROM 'LDAP://localhost:389/o=Microsoft,c=US' WHERE objectClass='*'"

    Set cmdSQL_Dialect.ActiveConnection = cn
    
    Dim rsSQL_Dialect As ADODB.Recordset
    Set rsSQL_Dialect = cmdSQL_Dialect.Execute
    Sheet1.Cells(1, 1).Value = "SQL Dialect query"
    Sheet1.Cells(2, 2).Value = "Name"    '* seems the fields are in reversed order, perhaps alphabetical?
    Sheet1.Cells(2, 1).Value = "DistinguishedName"
    Sheet1.Cells(3, 1).CopyFromRecordset rsSQL_Dialect

    Dim cmdLDAP_Dialect As ADODB.Command
    Set cmdLDAP_Dialect = New ADODB.Command
    cmdLDAP_Dialect.CommandText = ";(objectClass=*);CN; subtree"
    
    Set cmdLDAP_Dialect.ActiveConnection = cn
    
    Dim rsLDAP_Dialect As ADODB.Recordset
    Set rsLDAP_Dialect = cmdLDAP_Dialect.Execute
    
    Sheet1.Cells(1, 4).Value = "LDAP Dialect query"
    Sheet1.Cells(2, 4).Value = "CN"
    Sheet1.Cells(3, 4).CopyFromRecordset rsLDAP_Dialect
End Sub

ActiveDirectory with VBA Part 4 - ADSI Edit

So in Part 1 I installed Active Directory Lightweight Directory Services (AD LDS) and in Part 2 worked through a Technet tutorial to create an AD LDS instance, also in Part 3. I showed how to uninstall an instance to wipe the slate clean. I gave some code that connected to the AD LDS instance a the bottom of Part 2.

Next I proceed with the subsequent Technet tutorial as it creates users and groups with some Active Directory administrative tools.

So launching ADSI Edit you get a MMC looking welcome screen with no connections...

Following the tutorial for connecting the finished dialog box looks like this...

Once connected the left explorer pane should have a new AD LDS Demo icon which can be double-clicked for expansion...

Double clicking on 'O=Microsoft,c' shows the application directory partition...

Carrying onto the next Technet tutorial in series about creating users and groups. After this tutorial some new objects have been created reflected in this screenshot.

When finished the following VBA code should be able to reach, query and find each object mentioned in the tutorial. This will help setup test data for more involved user and group logic.

Option Explicit

Sub Test()

    Dim oDirectoryService As Object
    Set oDirectoryService = _
        GetObject("LDAP://localhost:389/o=Microsoft,c=US")
    Debug.Assert TypeName(oDirectoryService) = "Object"

    Dim oOU_AD_LDS_Users As Object
    Set oOU_AD_LDS_Users = GetObject( _
        "LDAP://localhost:389/OU=AD LDS Users,o=Microsoft,c=US")
    Debug.Assert TypeName(oOU_AD_LDS_Users) = "Object"

    Dim oGroup_AD_LDS_Testers As Object
    Set oGroup_AD_LDS_Testers = GetObject( _
        "LDAP://localhost:389/CN=AD LDS Testers,OU=AD LDS Users,o=Microsoft,c=US")
    Debug.Assert TypeName(oGroup_AD_LDS_Testers) = "Object"

    Dim oUser_MaryNorth As Object
    Set oUser_MaryNorth = GetObject( _
        "LDAP://localhost:389/CN=Mary North,OU=AD LDS Users,o=Microsoft,c=US")
    Debug.Assert TypeName(oUser_MaryNorth) = "Object"


End Sub

ActiveDirectory with VBA Part 3 - Technet AD LDS Deleting an Instance

So I have been following the Technet tutorial Practice Working with AD LDS Instances and it assumes that you have a fresh install or the defaults in the wizard will be different. If you have been through the steps you might want to wipe the slate clean. In this part I show how to delete an Active Directory Lightweight Directory Services (AD LDS) instance.

In the Control Panel search box type "uninstall" this will yield search results including for Uninstall a program under the header of Program and Features

Clicking on Uninstall a program yields a list of software which is uninstallable.

Double click and follow a few 'are you sure' type messages.

ActiveDirectory with VBA Part 2 - Technet AD LDS Sample Instance

So following on from installing Active Directory Lightweight Directory Services (AD LDS) in Part 1 here I follow the Technet tutorial Practice Working with AD LDS Instances and I supply the screenshots as I go.

So we run the Active Directory Lightweight Directory Services Setup Wizard and I did do this by searching for it with the Windows 8 metro search box, after allowing permission I get the following welcome box

Clicking Next I get to next box and choose 'A unique instance'

For the instance name I accept the default as I am following the tutorial. If you are doing these twice then instance1 is taken, you may want to skip to Part 3 where I show how to delete an instance.

For the port numbers again things will be different if you have already run these steps once and already have an instance because each instance must listen on a different port. See Part 3 for how to delete an instance.

Because we're opening ports then you may get a firewall warning message like this so I select private networks only...

And again I am following the tutorial so I follow instructions, create an application directory partition and give the Partition name as in the tutorial as 'o=Microsoft,c=US'.

Next we accept the default file locations

Next use Nework service account as per tutorial

Then you will get a replication not available type warning box, click Yes to continue.

Then you get the AD LDS Administrators box, note I have airbrushed my details from this slide. Click the default value of Currently logged on user.

On the Importing LDIF Files. Select the following MS-InetOrgPerson.ldf, MS-User.ldf, MS-UserProxy.ldf, MS-UserProxyFull.ldf, MS-ADLDS-DisplaySpecifiers.ldf. NOT ALL OF THESE ARE IMMEDIATELY VISIBLE, YOU NEED TO SCROLL

Then you get a confirmation screen...

Then it does some work...

Then you get some success splash screen.

Now you can write some code to connect to this new AD LDS instance. This should work if you went wrong you'll need to use Part 3 to delete instance and try again

Option Explicit

Sub Test()

    Dim oDirectoryService As Object
    Set oDirectoryService = GetObject("LDAP://localhost:389/o=Microsoft,c=US")
    Debug.Assert TypeName(oDirectoryService) = "Object"

End Sub

ActiveDirectory with VBA Part 1 - Installing AD LDS

So in various roles I've written code in production to query a corporate active directory to query for users and check group membership to drive permission logic. In those times, I always had a corporate instance of Windows Server to program against. What happens if you don't have access to a Windows Server using a ordinary desktop edition of Windows? I am using Windows 8.1 Professional Edition.

It might be tempting to download ApacheDS which is free but that cannot be accesed using VBA's GetObject("LDAP://CN=BillGates,DC=microsoft,DC=com").

You will need to use something like a development edition of Active Directory. Fortunately, a lightweight edition does exists, here is an overview of Active Directory Lightweight Directory Services (AD LDS) and here is a quote highlighting the development use case...

Providing a development environment for AD DS and AD LDS

Because AD LDS uses the same programming model and provides virtually the same administration experience as AD DS, it can be a good fit for developers who are staging and testing various Active Directory-integrated applications. For example, if an application under development requires a different schema from the current server operating system AD DS, the application developer can use AD LDS to provide the application with a tailored schema that works for business needs, data requirements, and workflow processes, without altering the configuration of the corporate Active Directory deployment. Developers can work with an AD LDS instance without the need for a complicated setup and later move the application to AD DS. Developers may want a directory that they can easily program to without requirements for extensive setup or hardware support during the development process. This can be achieved through AD LDS as it can easily be installed and uninstalled on any Windows Server 2008 computer. This allows rapid restoration to a clean state during the application prototyping and development process.

Luckily Active Directory Lightweight Directory Services (AD LDS) is an optional component if you are using Windows 8.1 (and hopefully other desktop editions of Windows), from the Metro interface search box type "Windows features" and then select "Turn Windows features on or off" which should be top hit. Then you should see the following dialog box where you can check "Active Directory Lightweight Directory Services"

Once installed, I followed a Technet tutorial about creating an AD LDS Instance and in Part 2. I'll show you my screenshots as I went through the steps.